Threat actors have been observed targeting Qlik Sense servers to unsuccessfully deliver PowerShell reverse shell commands against multiple environments in October 2026.
Cynet’s CyOps and Research teams said they identified the suspicious activity in October 2026 against several E.U.-based customers within a narrow window of just over three minutes.
The activity has been found to share some level of overlap with a November 2023 campaign documented by Arctic Wolf in which threat actors linked to the CACTUS ransomware operation likely weaponized then-newly-disclosed flaws in Qlik Sense to obtain initial access to target environments.
The vulnerabilities in question, which were patched by Qlik Sense in August and September 2023, impact Qlik Sense Enterprise for Windows –
- CVE-2023-41265 (CVSS score: 9.6) – An HTTP tunneling vulnerability that could lead to privilege escalation and allow an attacker to execute HTTP requests on the backend server hosting the repository application.
- CVE-2023-41266 (CVSS score: 8.2) – A path traversal vulnerability that could allow an unauthenticated remote attacker to generate an anonymous session and perform HTTP requests to unauthorized endpoints.
- CVE-2023-48365 (CVSS score: 9.6) – An unauthenticated remote code execution vulnerability that stems from improper validation of HTTP headers, allowing an attacker to elevate their privilege by tunneling HTTP requests and execute HTTP requests on the backend server.
It’s worth noting that CVE-2023-48365 (aka DoubleQlik) is an incomplete fix for CVE-2023-41265.
In November 2023 CACTUS ransomware campaign, threat actors were observed exploiting the flaws to establish a foothold and download additional payloads to establish persistence and remote control by deploying ManageEngine Unified Endpoint Management and Security (UEMS), AnyDesk, and Plink.
The latest activity detected by Cynet involves the use of a PowerShell command containing a one-line reverse shell that connects to “45.115.26[.]23” on port 4455. The exact vulnerability exploited to break into Qlik Sense servers is currently not known.
“The command was executed under scheduler.exe, resembling the 2023 Cactus Qlik intrusions,” the cybersecurity company said.
Although attempts to spawn the reverse shell were blocked, Cynet’s testing of the reverse shell in a controlled environment has revealed that the interactive communication channel is used to conduct reconnaissance and deliver a PowerShell script for enabling persistence.
This is achieved by means of a Windows Go reverse shell that connects to “45.115.26[.]23:4456.” The backdoor is then used to look for actively running processes related to Apache ActiveMQ. On Linux, the malware also attempts to collect system information and read “/etc/shadow” and “/etc/passwd” files.
A second variant of the PowerShell script attempts to install OpenSSH and creates a scheduled task named “WinUpdCheck” that launches a PowerShell reverse shell written to “C:ProgramDatasshwinc.ps1” at five-minute intervals.
“If sshd remained unavailable, it downloaded OpenSSH-Win64.zip from the staging server, extracted it, and ran install-sshd.ps1,” Cynet said. “It set sshd to automatic startup, started the service, and added an inbound firewall rule for TCP 22. The archive was a legitimate OpenSSH package reused by the operator.”
Further analysis of the infrastructure has uncovered an exposed directory (“45.115.26[.]23:8012”) consisting of a custom Go backdoor for Windows, SSH persistence scripts, an ActiveMQ exploit for CVE-2023-46604, and a modified public Veeam toolchain for CVE-2024-40711, indicating the threat actor is possibly laying the groundwork for broader attacks.
